Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enforce Data Exchange (only) on USB Removable Media for all users of a PC

Hi there,

We're having some problems with a basic setup and wonder if more experienced users could point us in the right direction.

We have SafeGuard Management Center 7, but a mix of 6 and 7 clients, used previously to encrypt laptops so all working fine.

Our new objectives:

For most desktop Win 7 PCs we now wish to enforce encryption of USB removable media;

We want the policy to apply to any user of that PC, as almost any of our PCs can be used by any of our users;

We do not want POA, or volume encryption, only Data Exchange, and that to only apply to removable media, so file-based not volume-based;

We have enabled generation of Group Keys as we wish to use Group Keys so users in-house can seamlessly exchange USB devices and files;

SGPortable can be used for external recipients.

We have no problem getting the PreInstall, Client, and the Config onto the PCs.

The problem:

How to assign all our users to a PC or ideally to an OU?  It seems only possible to assign individual users to a PC.  If I create a group of users and assign that group, the users are individually enumerated in the assignment.

Then when attempting to save the configuration after adding the users, I get an error such as attached,

"You have already assigned a max of 0 user(s).  Please remove 110 object(s)"

We have 250 available DE licences, so even if the license is per user, this doesn't make sense.  (Although we thought the license was per device?). 

After going round in circles with this one for some days now, I'm getting confused between AD groups, Safeguard groups, group keys, OUs etc...

All we want to do is assign everybody to each configured PC in the simplest possible way (i.e. groups) all using the same group key.

If someone could point out where we are going wrong, this would be much appreciated.  Thanks in advance,

Dave T

:55823


This thread was automatically locked due to age.
Parents
  • Ok, making progress here, the Credential Provider seems to manage different users on the same PC, users now just have to wait for SafeGuard Authentication Service notification to complete after logon.

    That leads on to the next 2 issues, one minor one major:

    Minor issue 1: Windows 7 users are now presented with a SafeGuard icon AND a normal WIn7 icon, see attachment.  Any way to remove the normal Win7 icon and leave only the SGN icon?  More pressing, is there any difference to the logon should they choose the Win7 icon?

    Major issue 2: If a user locks a PC and walks away, no-one else can log on, Switch User fails by allowing the next user to log on and then immediately logging them off.  As stated in the original post, we have some PCs shared by many users, but this locks a PC to one user.

    Is this expected behaviour?  Is there a workaround?

    Forcing logoff by policy in Win7 is not a trivial task; hard booting to allow next user logon is not acceptable; educating users to logoff is an endless task...

    Thanks for the advice so far, but we're not out of the woods yet!

    Regards

    Dave T

    :56242
Reply
  • Ok, making progress here, the Credential Provider seems to manage different users on the same PC, users now just have to wait for SafeGuard Authentication Service notification to complete after logon.

    That leads on to the next 2 issues, one minor one major:

    Minor issue 1: Windows 7 users are now presented with a SafeGuard icon AND a normal WIn7 icon, see attachment.  Any way to remove the normal Win7 icon and leave only the SGN icon?  More pressing, is there any difference to the logon should they choose the Win7 icon?

    Major issue 2: If a user locks a PC and walks away, no-one else can log on, Switch User fails by allowing the next user to log on and then immediately logging them off.  As stated in the original post, we have some PCs shared by many users, but this locks a PC to one user.

    Is this expected behaviour?  Is there a workaround?

    Forcing logoff by policy in Win7 is not a trivial task; hard booting to allow next user logon is not acceptable; educating users to logoff is an endless task...

    Thanks for the advice so far, but we're not out of the woods yet!

    Regards

    Dave T

    :56242
Children
No Data